Breaking

Cloudflare Open-Sources Security Audit Skill for Coding Agents

October 5, 2026 at 14:17 EDT

AI Agents
Security
Open Source

Cloudflare has open-sourced security-audit, a coding-agent skill designed to turn tool-using agents into structured security auditors for codebases. The project coordinates isolated agents through a six-phase workflow that moves from reconnaissance to target-neutral reporting, with findings written as machine-readable JSON and checked by zero-dependency Node.js validators.

Oct. 2026 · Cloudflare

Security audits become an agent workflow

Cloudflare open-sourced a coding-agent skill that turns vulnerability review into a structured, verified, machine-readable process.

Audit phases from reconnaissance to reporting

Zero-dependency Node.js validators

~450

Lines in the earlier internal skill

Why repeated runs matter

~50%

Single run

100%

Repeated-run total

Cloudflare says one pass found roughly half of what repeated runs found in total, making coverage tracking central to the design.

Audit loop

Recon

Map architecture and trust boundaries.

→

Hunt

Assign isolated agents to coverage units.

→

Verify

Fresh agents try to disprove each claim.

→

Report

Emit JSON and human-readable artifacts.

What developers gain

A repeatable audit grammar with phases, verdicts, artifacts and machine-checkable output.

What still limits it

Without a proper sandbox or multiple passes, findings remain partial and may stay in needs-validation status.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.